12 files changed, 42 insertions, 115 deletions
diff --git a/roles/network/meta/argument_specs.yml b/roles/network/meta/argument_specs.yml
index 86df33c6..f85318a8 100644
--- a/roles/network/meta/argument_specs.yml
+++ b/roles/network/meta/argument_specs.yml
@@ -30,3 +30,7 @@ argument_specs:
       network_ipv6_dns:
         type: "str"
         description: "The network IP(4) gateway to configure when provided"
+      network_bridge:
+        type: "str"
+        description: "Bridge interface name — when set, ethernet becomes bridge port and bridge connection is created"
+        required: false
diff --git a/roles/network/tasks/main.yml b/roles/network/tasks/main.yml
index 2cbb2513..1268b3cd 100644
--- a/roles/network/tasks/main.yml
+++ b/roles/network/tasks/main.yml
@@ -103,6 +103,15 @@
         owner: "root"
         group: "root"
 
+    - name: "Configure bridge connection"
+      ansible.builtin.template:
+        src: "bridge.nmconnection.j2"
+        dest: "/etc/NetworkManager/system-connections/{{ network_bridge }}.nmconnection"
+        mode: "0600"
+        owner: "root"
+        group: "root"
+      when: network_bridge is defined
+
     - name: "Configure wifi connection"
       ansible.builtin.template:
         src: "wifi-connection.nmconnection.j2"
diff --git a/roles/pve-network/templates/vmbr0.nmconnection.j2 b/roles/network/templates/bridge.nmconnection.j2
index 013acd6a..2e8bf23c 100644
--- a/roles/pve-network/templates/vmbr0.nmconnection.j2
+++ b/roles/network/templates/bridge.nmconnection.j2
@@ -1,7 +1,7 @@
 [connection]
-id=vmbr0
+id={{ network_bridge }}
 type=bridge
-interface-name=vmbr0
+interface-name={{ network_bridge }}
 autoconnect=true
 
 [bridge]
diff --git a/roles/network/templates/eth0-connection.nmconnection.j2 b/roles/network/templates/eth0-connection.nmconnection.j2
index 666b0360..6a6481c4 100644
--- a/roles/network/templates/eth0-connection.nmconnection.j2
+++ b/roles/network/templates/eth0-connection.nmconnection.j2
@@ -2,12 +2,18 @@
 id=ethernet
 type=ethernet
 autoconnect=true
+{% if network_bridge is defined %}
+controller={{ network_bridge }}
+port-type=bridge
+{% endif %}
 
 [ethernet]
 cloned-mac-address=permanent
 
 [ipv4]
-{% if network_ipv4_address is defined %}
+{% if network_bridge is defined %}
+method=disabled
+{% elif network_ipv4_address is defined %}
 method=manual
 addresses={{ network_ipv4_address }}
 gateway={{ network_ipv4_gateway }}
@@ -20,7 +26,9 @@ method=auto
 
 [ipv6]
 addr-gen-mode=default
-{% if network_ipv6_address is defined %}
+{% if network_bridge is defined %}
+method=disabled
+{% elif network_ipv6_address is defined %}
 method=manual
 addresses={{ network_ipv6_address }}
 gateway={{ network_ipv6_gateway }}
diff --git a/roles/pve-network/defaults/main.yml b/roles/pve-network/defaults/main.yml
deleted file mode 100644
index f56c943e..00000000
--- a/roles/pve-network/defaults/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-pve_network_interface: "eth0"
diff --git a/roles/pve-network/handlers/main.yml b/roles/pve-network/handlers/main.yml
deleted file mode 100644
index 7a4ce4c0..00000000
--- a/roles/pve-network/handlers/main.yml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-- name: "Restart NetworkManager"
-  become: true
-  ansible.builtin.systemd_service:
-    name: "NetworkManager"
-    state: "restarted"
-  async: 10
-  poll: 0
-
-- name: "Restart pveproxy"
-  become: true
-  ansible.builtin.systemd_service:
-    name: "pveproxy"
-    state: "restarted"
-  tags:
-    - "molecule-notest"
diff --git a/roles/pve-network/meta/argument_specs.yml b/roles/pve-network/meta/argument_specs.yml
deleted file mode 100644
index 6f93a13b..00000000
--- a/roles/pve-network/meta/argument_specs.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-argument_specs:
-  main:
-    options:
-      pve_network_interface:
-        type: "str"
-        description: "Physical ethernet interface to add as bridge port"
-        default: "enp0s25"
-      network_ipv4_address:
-        type: "str"
-        description: "Static IPv4 address for vmbr0"
-        required: true
-      network_ipv4_prefix:
-        type: "int"
-        description: "IPv4 prefix length"
-        default: 24
-      network_ipv4_gateway:
-        type: "str"
-        description: "IPv4 default gateway"
-        required: true
-      network_ipv4_dns:
-        type: "str"
-        description: "IPv4 DNS server"
-      network_ipv6_address:
-        type: "str"
-        description: "Static IPv6 address for vmbr0 (optional)"
-      network_ipv6_gateway:
-        type: "str"
-        description: "IPv6 default gateway (required if network_ipv6_address is set)"
-      network_ipv6_dns:
-        type: "str"
-        description: "IPv6 DNS server"
diff --git a/roles/pve-network/meta/main.yml b/roles/pve-network/meta/main.yml
deleted file mode 100644
index e7c9c044..00000000
--- a/roles/pve-network/meta/main.yml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-dependencies:
-  - role: "network"
-  - role: "pve"
-galaxy_info:
-  author: "a14m"
-  description: "Configure vmbr0 bridge on Proxmox VE via NetworkManager"
-  license: "MIT"
-  min_ansible_version: "2.18"
-  platforms:
-    - name: "Debian"
-      versions:
-        - "bookworm"
diff --git a/roles/pve-network/tasks/main.yml b/roles/pve-network/tasks/main.yml
deleted file mode 100644
index f7db0195..00000000
--- a/roles/pve-network/tasks/main.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Set management IP in /etc/hosts for PVE cert generation"
-  become: true
-  ansible.builtin.lineinfile:
-    path: "/etc/hosts"
-    regexp: "^{{ network_ipv4_address }}"
-    line: "{{ network_ipv4_address }}  {{ ansible_facts['hostname'] }}"
-    state: present
-  notify: "Restart pveproxy"
-  tags:
-    # pveproxy not available in containers — requires proxmox-ve package
-    - "molecule-notest"
-
-- name: "Deploy bridge master connection"
-  become: true
-  ansible.builtin.template:
-    src: "vmbr0.nmconnection.j2"
-    dest: "/etc/NetworkManager/system-connections/vmbr0.nmconnection"
-    owner: "root"
-    group: "root"
-    mode: "0600"
-  notify: "Restart NetworkManager"
-
-- name: "Override ethernet connection as bridge port"
-  become: true
-  ansible.builtin.template:
-    src: "ethernet.nmconnection.j2"
-    dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection"
-    owner: "root"
-    group: "root"
-    mode: "0600"
-  notify: "Restart NetworkManager"
diff --git a/roles/pve-network/templates/ethernet.nmconnection.j2 b/roles/pve-network/templates/ethernet.nmconnection.j2
deleted file mode 100644
index 2aaa85b0..00000000
--- a/roles/pve-network/templates/ethernet.nmconnection.j2
+++ /dev/null
@@ -1,16 +0,0 @@
-[connection]
-id={{ pve_network_interface }}-bridge-port
-type=ethernet
-interface-name={{ pve_network_interface }}
-autoconnect=true
-controller=vmbr0
-port-type=bridge
-
-[ethernet]
-cloned-mac-address=permanent
-
-[ipv4]
-method=disabled
-
-[ipv6]
-method=disabled
diff --git a/roles/pve/tasks/main.yml b/roles/pve/tasks/main.yml
index 8c54c27c..494fc7aa 100644
--- a/roles/pve/tasks/main.yml
+++ b/roles/pve/tasks/main.yml
@@ -1,4 +1,16 @@
 ---
+- name: "Set management IP in /etc/hosts for PVE cert generation"
+  become: true
+  ansible.builtin.template:
+    src: "hosts.j2"
+    dest: "/etc/hosts"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  tags:
+    # pveproxy not available in containers — requires proxmox-ve package
+    - "molecule-notest"
+
 - name: "Install proxmox-ve"
   become: true
   ansible.builtin.apt:
diff --git a/roles/pve/templates/hosts.j2 b/roles/pve/templates/hosts.j2
new file mode 100644
index 00000000..5cebad3c
--- /dev/null
+++ b/roles/pve/templates/hosts.j2
@@ -0,0 +1,5 @@
+127.0.0.1   localhost
+{{ network_ipv4_address }}  {{ ansible_facts['hostname'] }}
+::1         localhost ip6-localhost ip6-loopback
+ff02::1     ip6-allnodes
+ff02::2     ip6-allrouters